Sunturai
Back to results
MediumMicrosoft Sentinel analytics

Port Scan

Identifies a source IP scanning multiple open ports on Azure Firewall. This can indicate malicious scanning of ports by an attacker, trying to reveal open ports in the organization that can be compromised for initial…

Description

Identifies a source IP scanning multiple open ports on Azure Firewall. This can indicate malicious scanning of ports by an attacker, trying to reveal open ports in the organization that can be compromised for initial access. Configurable Parameters: - Port scan time - the time range to look for multiple ports scanned. Default is set to 30 seconds. - Minimum different ports threshold - alert only if more than this number of ports scanned. Default is set to 100.

Detection logic

Detection requirements

Platform
ContainersIaaSLinuxmacOSNetwork DevicesPREWindows

The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.

Log source product
azurefirewall
Log source service
azfwapplicationruleazfwnetworkruleazurediagnostics

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice